fix(security): harden auth and secret handling (HH-444) (#101)

* fix(security): harden auth and credential handling (HH-444)

* fix(security): address HH-444 review blockers

* fix(security): close remaining HH-444 review blockers

---------

Co-authored-by: Rogee <rogee@ipao.vip>

frontend/app/javascript/dashboard/helper/APIHelper.js

@@ -1,31 +1,48 @@
 import Auth from '../api/auth';
 
 const parseErrorCode = error => Promise.reject(error);
+const AUTH_HEADERS = ['access-token', 'token-type', 'client', 'expiry', 'uid'];
 
 export default axios => {
   const { apiHost = '' } = window.chatwootConfig || {};
-  const wootApi = axios.create({ baseURL: `${apiHost}/` });
-  // Add Auth Headers to requests if logged in
-  if (Auth.hasAuthCookie()) {
-    const {
-      'access-token': accessToken,
-      'token-type': tokenType,
-      client,
-      expiry,
-      uid,
-    } = Auth.getAuthData();
-    Object.assign(wootApi.defaults.headers.common, {
-      'access-token': accessToken,
-      'token-type': tokenType,
-      client,
-      expiry,
-      uid,
-    });
-  }
-  // Response parsing interceptor
+  const wootApi = axios.create({
+    baseURL: `${apiHost}/`,
+    withCredentials: true,
+  });
+  const authHeaders = {};
+  let refreshRequest;
+
+  wootApi.interceptors.request.use(config => {
+    Object.assign(config.headers, authHeaders);
+    return config;
+  });
   wootApi.interceptors.response.use(
-    response => response,
-    error => parseErrorCode(error)
+    response => {
+      AUTH_HEADERS.forEach(header => {
+        if (response.headers?.[header])
+          authHeaders[header] = response.headers[header];
+      });
+      return response;
+    },
+    async error => {
+      const request = error.config;
+      if (
+        error.response?.status !== 401 ||
+        request?._retry ||
+        request?._sessionRefresh ||
+        !Auth.hasAuthCookie()
+      ) {
+        return parseErrorCode(error);
+      }
+      request._retry = true;
+      refreshRequest ||= wootApi
+        .get('/auth/validate_token', { _sessionRefresh: true })
+        .finally(() => {
+          refreshRequest = null;
+        });
+      await refreshRequest;
+      return wootApi(request);
+    }
   );
   return wootApi;
 };